✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start") and
process.parent.name == "dbus-daemon" and process.args_count > 1 and not (
  process.parent.args == "--session" or
  process.args in ("/usr/lib/software-properties/software-properties-dbus", "/usr/share/backintime/qt/serviceHelper.py") or
  process.name in ("dbus-daemon-launch-helper", "gnome-keyring-daemon", "abrt-dbus", "aptd", "usb-creator-helper") or
  process.executable like (
    "/usr/lib/*", "/usr/local/lib/*", "/usr/libexec/*", "/tmp/newroot/*", "/usr/sbin/setroubleshootd",
    "/usr/share/setroubleshoot/SetroubleshootPrivileged.py",
    "/var/lib/awx/.local/share/containers/storage/overlay/*/SetroubleshootPrivileged.py",
    "/home/*/.local/share/containers/storage/overlay/*/SetroubleshootPrivileged.py",
    "/bin/rpm", "/run/user/*/.bubblewrap/newroot/usr/libexec/rhsmd", "/opt/CrowdStrike/sandbox/usr/libexec/rhsmd",
    "/run/user/*/.bubblewrap/*/setroubleshootd"
  ) or
  (
    process.name like "python*" and
    process.args in (
      "/usr/share/usb-creator/usb-creator-helper", "/usr/sbin/aptd", "/usr/sbin/aptk", "/usr/bin/hp-pkservice",
      "/usr/libexec/language-selector/ls-dbus-backend"
    )
  ) or
  (process.name == "perl" and process.args like "/usr/share/system-tools-backends-*.pl") or
  ?process.working_directory like "/run/user/*/.bubblewrap/newroot/var/lib/gdm/"
)